来源

关联漏洞

描述

CVE-2021-36934 HiveNightmare vulnerability checker and workaround

介绍

# CVE-2021-36934
CVE-2021-36934 HiveNightmare vulnerability checker and workaround

### Flow

The script has the following flow:

- Requires it to run with Administrator privileges
- Check Windows 10 version is affected by the vulnerability.
  - IF affected by vulnerability:
    - Show Windows version may be affected by the vulnerability message
    - Check if the hive system files permissions are accessible by BUILTIN\Users
      - IF it is vulnerable:
        - Apply the workaround proposed by Microsoft https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-36934
        - Check for Shadow Volume Copies
          - IF it exist:
            - Show the message: There are vulnerable shadow copies on the system
            - Delete existing shadow volume copies and show the message: Shadow copies have been removed
            - A new restore point is created with the name "Restorepoint for CVE-2021-36934 HiveNightmare" and show the message: A new restore point has been created
          - If it does NOT exist:
            - Show the message: No shadow copies found
            - Show the message: System is not vulnerable
      - If NOT vulnerable:
        - Show the message: No vulnerable hive system files found
        - Show the message: System is not vulnerable
  - If NOT affected by vulnerability:
    - Show the message: Operating System is not vulnerable

### Considerations

- Once the script to fix the vulnerability has been run, it can be run again to see if it has been fixed.
- Workaround will apply only to affected systems.
- The script works correctly with any language setting
- Some EDR systems may detect this script as suspicious behavior and stop its execution, due to the shadow volume being deleted. It is recommended to add as an exception.

### Outputs

If it is vulnerable and it has been fixed, we will get the following result: 

![HiveNightmare System is vulnerable](https://i.imgur.com/N3HQSKG.png)


If it is not vulnerable, we will get the following result:
![HiveNightmare System is not vulnerable](https://i.imgur.com/IrRwyzQ.png)

文件快照

 [4.0K]  /data/pocs/e54c3fbed3ba9164c6d3cb138b65533083e14086
├── [3.5K]  hivenightmare.ps1
├── [ 34K]  LICENSE
└── [2.0K]  README.md

0 directories, 3 files

备注